Security: restricted project changes to its creator, added default avatar